Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page POP UP CITY, part 2
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 02-21-2009, 09:44 AM   #1 (permalink)
Registered User
 
Join Date: Feb 2008
Posts: 9
OS: vista


POP UP CITY, part 2
Cont'd from here:

Pop up CITY

Hi all, I have a standard XP computer that randomly started having popups show up. They are always in internet explorer if that makes a difference. I feel like I've done every offline and online system scan, it always finds "infected" files and supposedly gets rid of the malware. I've download tons of pop up blockers, ones that reside in the system tray and those in the internet browser toolbars like Google Toolbar. Basically, I feel like i've done a lot and still have no success....the popups come about one every 5 minutes. Any ideas? Thanks much! I've included the logs, etc. below

Cedric


DDS (Ver_09-02-01.01) - NTFSx86
Run by Kristen at 11:10:34.46 on Sat 02/21/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.180 [GMT -5:00]

AV: PC Tools AntiVirus 5.0.1.1 *On-access scanning enabled* (Outdated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k bthsvcs
C:\WINDOWS\system32\o2flash.exe
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Phoenix Technologies\cME\Guard\Guard.exe
C:\Program Files\mobile PhoneTools\WatchDog.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\PC Tools AntiVirus\PCTAV.exe
C:\WINDOWS\system32\PhnxCDSvr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VnrPack\VnrPack23.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\NETGEAR\MA101 USB Adapter Configuration Utility\WlanMonitor.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Kristen\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.averatec.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
{bee83f72-84c7-8b35-bf2e-f18a348428e2}
TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
EB: {11B97CF9-C40E-4127-801D-0FE00EB35705} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [AIM] c:\program files\aim\aim.exe -cnetwait.odl
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
uRun: [MapEDC] c:\program files\mapedc\MapEDC.exe
uRun: [NoDNS] c:\program files\\nodns\\NoDNS.exe
uRun: [nvcoi] c:\program files\nvcoi\nvcoi.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [VnrPack23] "c:\program files\vnrpack\VnrPack23.exe"
uRun: [RegistryMechanic] c:\program files\registry mechanic\RegMech.exe /H
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [KTPWare] c:\program files\elantech\Ktp.exe
mRun: [AudioDeck] c:\program files\viaudioi\sbadeck\ADeck.exe 1
mRun: [SMSERIAL] sm56hlpr.exe
mRun: [VTTimer] VTTimer.exe
mRun: [VTTrayp] VTtrayp.exe
mRun: [RestoreIT!] "c:\program files\phoenix technologies\cme\rpro\ xp\VBPTASK.EXE" VBStart
mRun: [Eval] "c:\program files\phoenix technologies\cme\rpro\eval\Eval.exe"
mRun: [Guard] "c:\program files\phoenix technologies\cme\guard\Guard.exe" /background
mRun: [WatchDog] c:\program files\mobile phonetools\WatchDog.exe
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_03\bin\jusched.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [PCTAVApp] "c:\program files\pc tools antivirus\PCTAV.exe" /MONITORSCAN
mRun: [TrojanScanner] c:\program files\trojan remover\Trjscan.exe /boot
mRunServices: [fzxpzoze] c:\windows\system32\fzxpzoze.exe
dRunOnce: [FlashPlayerUpdate] c:\progra~1\mozill~1\plugins\NPSWF32_FlashUtil.exe -p
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ma101c~1.lnk - c:\program files\netgear\ma101 usb adapter configuration utility\WlanMonitor.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
uPolicies-system: DisableRegedit = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll
Trusted Zone: widener.edu\alias
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://active.macromedia.com/director/cabs/sw.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\kristen\applic~1\mozilla\firefox\profiles\l9jz0ydt.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-i3752&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.gmail.com/
FF - prefs.js: keyword.URL - hxxp://www.ffgoo.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\documents and settings\kristen\application data\mozilla\firefox\profiles\l9jz0ydt.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
FF - component: c:\documents and settings\kristen\application data\mozilla\firefox\profiles\l9jz0ydt.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll

---- FIREFOX POLICIES ----

FF - user.js: browser.search.selectedEngine - GoogleCOM
FF - user.js: keyword.URL - hxxp://www.ffgoo.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
c:\program files\mozilla firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\mozilla firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true);

============= SERVICES / DRIVERS ===============

R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2005-7-17 32320]
R0 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2005-7-17 23200]
R0 ptpd;Disk Filter Driver;c:\windows\system32\drivers\ptpd.sys [2005-7-21 6656]
R0 RITCPT;RITCPT;c:\windows\system32\drivers\RITCPT.SYS [2005-7-21 43512]
R2 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2008-1-4 587096]
R2 AVFilter;AVFilter;c:\windows\system32\drivers\AVFilter.sys [2009-2-15 21904]
R2 FBAPI;FBAPI;c:\windows\system32\drivers\FBAPI.sys [2005-7-21 5088]
R2 Machnm32;Machnm32 Driver;c:\windows\system32\Machnm32.sys [2005-7-21 2304]
R2 PCTAVSvc;PC Tools AntiVirus Engine;c:\program files\pc tools antivirus\PCTAVSvc.exe [2009-2-15 999640]
R3 AVHook;AVHook;c:\windows\system32\drivers\AVHook.sys [2009-2-15 28568]
R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.SYS [2006-5-10 17149]
R3 PhnxVcd;PhnxVcd;c:\windows\system32\drivers\phnxvcd.sys [2005-7-21 36096]
S2 cmdService;Command Service; [x]
S2 Network Monitor;Network Monitor; [x]
S3 Ktp;Elantech Touchpad;c:\windows\system32\drivers\Ktp.sys [2005-7-17 26112]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-2-15 38496]
S3 NETGEAR NETGEAR MA101 USB Adapter(A);NETGEAR NETGEAR MA101 USB Adapter(A) Service for NETGEAR MA101 USB Adapter;c:\windows\system32\drivers\MA1012KA.SYS [2006-5-10 73728]
S3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\PLCNDIS5.SYS [2002-9-9 17018]

=============== Created Last 30 ================

2009-02-15 19:34 162,304 a------- c:\windows\system32\ztvunrar36.dll
2009-02-15 19:34 153,088 a------- c:\windows\system32\UNRAR3.dll
2009-02-15 19:34 77,312 a------- c:\windows\system32\ztvunace26.dll
2009-02-15 19:34 75,264 a------- c:\windows\system32\unacev2.dll
2009-02-15 19:34 69,632 a------- c:\windows\system32\ztvcabinet.dll
2009-02-15 19:34 <DIR> --d----- c:\program files\Trojan Remover
2009-02-15 19:34 <DIR> --d----- c:\docume~1\kristen\applic~1\Simply Super Software
2009-02-15 19:34 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Simply Super Software
2009-02-15 19:33 <DIR> --d----- c:\windows\EHome
2009-02-15 18:56 0 a------- c:\windows\system32\atmtd.dll.tmp
2009-02-15 18:31 <DIR> --d----- c:\docume~1\kristen\applic~1\PC Tools
2009-02-15 18:28 <DIR> --d----- c:\docume~1\kristen\applic~1\Malwarebytes
2009-02-15 18:28 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-15 18:28 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-15 18:28 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-15 18:28 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-15 18:27 <DIR> --d----- c:\docume~1\kristen\applic~1\IObit
2009-02-15 18:27 <DIR> --d----- c:\program files\IObit
2009-02-15 18:26 <DIR> --d----- c:\program files\common files\PC Tools
2009-02-15 18:26 28,568 a------- c:\windows\system32\drivers\AVHook.sys
2009-02-15 18:26 21,912 a------- c:\windows\system32\drivers\AVRec.sys
2009-02-15 18:26 21,904 a------- c:\windows\system32\drivers\AVFilter.sys
2009-02-15 18:26 <DIR> --d----- c:\program files\PC Tools AntiVirus
2009-02-15 18:26 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Tools
2009-02-15 18:26 1,081,616 a------- c:\windows\system32\MSCOMCTL.OCX
2009-02-10 16:30 <DIR> --d----- c:\program files\Network Monitor
2009-02-10 16:26 <DIR> --d----- c:\program files\VnrPack
2009-02-10 16:26 <DIR> --d----- c:\program files\iCheck
2009-01-25 19:50 <DIR> --d----- c:\program files\jZip

==================== Find3M ====================

2008-12-20 18:15 826,368 a------- c:\windows\system32\wininet.dll
2007-10-23 18:29 32,177 ---sh--- c:\program files\common files\Yazzle1122OinUninstaller.exe
2006-11-07 20:42 92,064 a------- c:\documents and settings\kristen\mqdmmdm.sys
2006-11-07 20:42 79,328 a------- c:\documents and settings\kristen\mqdmserd.sys
2006-11-07 20:42 66,656 a------- c:\documents and settings\kristen\mqdmbus.sys
2006-11-07 20:42 25,600 a------- c:\documents and settings\kristen\usbsermptxp.sys
2006-11-07 20:42 22,768 a------- c:\documents and settings\kristen\usbsermpt.sys
2006-11-07 20:42 9,232 a------- c:\documents and settings\kristen\mqdmmdfl.sys
2006-11-07 20:42 6,208 a------- c:\documents and settings\kristen\mqdmcmnt.sys
2006-11-07 20:42 5,936 a------- c:\documents and settings\kristen\mqdmwhnt.sys
2006-11-07 20:42 4,048 a------- c:\documents and settings\kristen\mqdmcr.sys
2005-07-29 15:24 472 a--shr-- c:\windows\s3jpc3rlbg\maLDwal5v0.vbs
2008-03-09 18:49 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat

============= FINISH: 11:11:39.60 ===============



GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-02-21 11:20:59
Windows 5.1.2600 Service Pack 2


---- Devices - GMER 1.0.14 ----

AttachedDevice \FileSystem\Ntfs \Ntfs AVHook.sys (PC Tools Filter Driver for Windows 2000/XP/PC Tools Research Pty Ltd.)
AttachedDevice \FileSystem\Ntfs \Ntfs AVRec.sys (PC Tools Recognizer Driver for Windows 2000/XP/PC Tools Research Pty Ltd )

Device \FileSystem\Fastfat \Fat EF622C8A

AttachedDevice \FileSystem\Fastfat \Fat AVHook.sys (PC Tools Filter Driver for Windows 2000/XP/PC Tools Research Pty Ltd.)

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00125a9bc5e2
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00125a9bc5e2

---- EOF - GMER 1.0.14 ----
Attached Files
File Type: zip tech.zip (8.0 KB, 2 views)
louriec is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 02-21-2009, 07:26 PM   #2 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,761
OS: 2000 Pro; XP Pro; XP Home


Re: POP UP CITY, part 2
Hello again. Now that you have the proper logs, we can continue.

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

---------------------------------------------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum.

---------------------------------------------------------------------------------------------

Please visit this webpage for download links, and instructions for running combofix:

http://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-22-2009, 06:52 PM   #3 (permalink)
Registered User
 
Join Date: Feb 2008
Posts: 9
OS: vista


Re: POP UP CITY, part 2
ComboFix 09-02-21.01 - Kristen 2009-02-22 20:38:01.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.99 [GMT -5:00]
Running from: c:\documents and settings\Kristen\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Kristen\Application Data\DOBE~1
c:\documents and settings\Kristen\Application Data\Facegame
c:\documents and settings\Kristen\Application Data\Facegame\Facegame.exe.vir
c:\documents and settings\Kristen\Application Data\Facegame\Facegame.exe5s5
c:\documents and settings\Kristen\Application Data\GetModule
c:\documents and settings\Kristen\Application Data\GetModule\dicik.gz
c:\documents and settings\Kristen\Application Data\GetModule\kwdik.gz
c:\documents and settings\Kristen\Application Data\GetModule\ofadik.gz
c:\documents and settings\Kristen\Application Data\ICROSO~1
c:\documents and settings\Kristen\Application Data\ICROSO~1.NET
c:\documents and settings\Kristen\Application Data\MCROSO~1
c:\documents and settings\Kristen\Application Data\MCROSO~1\r?ndll32.exe
c:\documents and settings\Kristen\Application Data\WNSXS~1
c:\documents and settings\Kristen\Local Settings\Temporary Internet Files\fbk.sts
c:\documents and settings\Kristen\Start Menu\Programs\Outerinfo
c:\documents and settings\Kristen\Start Menu\Programs\Outerinfo\Terms.lnk
c:\documents and settings\Kristen\Start Menu\Programs\Outerinfo\Uninstall.lnk
c:\documents and settings\LocalService\Application Data\NetMon
c:\documents and settings\LocalService\Application Data\NetMon\domains.txt
c:\documents and settings\LocalService\Application Data\NetMon\log.txt
c:\program files\asks~1
c:\program files\Common Files\racle~1
c:\program files\Common Files\racle~1\?racle\
c:\program files\Common Files\Yazzle1122OinUninstaller.exe
c:\program files\GetModule
c:\program files\GetModule\GetModule37.exe
c:\program files\iCheck
c:\program files\iCheck\Uninstall.exe
c:\program files\Internet Explorer\fsoxyrtiprem.html
c:\program files\JavaCore
c:\program files\JavaCore\UnInstall.exe
c:\program files\MapEDC
c:\program files\MapEDC\IDE.stt
c:\program files\network monitor
c:\program files\network monitor\netmon.exe.vir
c:\program files\NoDNS
c:\program files\NoDNS\UnInstall.exe
c:\program files\nvcoi
c:\program files\nvcoi\mst.stt
c:\program files\outerinfo
c:\program files\outerinfo\FF\chrome.manifest
c:\program files\outerinfo\FF\components\FF.dll.vir
c:\program files\outerinfo\FF\components\OuterinfoAds.xpt
c:\program files\outerinfo\FF\install.rdf
c:\program files\outerinfo\OiUninstaller.exe
c:\program files\outerinfo\outerinfo.ico
c:\program files\outerinfo\Terms.rtf
c:\program files\sembly~1
c:\program files\Temporary
c:\program files\VnrPack
c:\program files\VnrPack\dicts.gz
c:\program files\VnrPack\trgts.gz
c:\program files\VnrPack\VnrPack23.exe
c:\windows\curity~1
c:\windows\system32\atmtd.dll.tmp
c:\windows\system32\fnts~1
c:\windows\system32\wintsvtr.exe
c:\windows\uninstall_nmon.vbs

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CMDSERVICE
-------\Legacy_NETWORK_MONITOR
-------\Service_cmdService
-------\Service_Network Monitor


((((((((((((((((((((((((( Files Created from 2009-01-23 to 2009-02-23 )))))))))))))))))))))))))))))))
.

2009-02-21 11:32 . 2009-02-21 11:32 <DIR> d-------- c:\documents and settings\All Users\Application Data\WinZip
2009-02-21 11:26 . 2009-02-21 11:26 <DIR> d-------- c:\program files\7-Zip
2009-02-21 11:15 . 2009-02-21 11:15 250 --a------ c:\windows\gmer.ini
2009-02-15 19:34 . 2009-02-22 20:30 <DIR> d-------- c:\program files\Trojan Remover
2009-02-15 19:34 . 2006-05-25 14:52 162,304 --a------ c:\windows\system32\ztvunrar36.dll
2009-02-15 19:34 . 2003-02-02 19:06 153,088 --a------ c:\windows\system32\UNRAR3.dll
2009-02-15 19:34 . 2005-08-26 00:50 77,312 --a------ c:\windows\system32\ztvunace26.dll
2009-02-15 19:34 . 2002-03-06 00:00 75,264 --a------ c:\windows\system32\unacev2.dll
2009-02-15 19:34 . 2006-06-19 12:01 69,632 --a------ c:\windows\system32\ztvcabinet.dll
2009-02-15 19:33 . 2009-02-15 19:33 <DIR> d-------- c:\windows\EHome
2009-02-15 18:28 . 2009-02-15 18:28 <DIR> d-------- c:\documents and settings\Kristen\Application Data\Malwarebytes
2009-02-15 18:28 . 2009-02-15 18:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-15 18:27 . 2009-02-15 18:27 <DIR> d-------- c:\program files\IObit
2009-02-15 18:27 . 2009-02-15 18:27 <DIR> d-------- c:\documents and settings\Kristen\Application Data\IObit
2009-02-15 18:27 . 2009-02-22 20:32 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-02-15 18:26 . 2009-02-15 18:26 <DIR> d-------- c:\program files\Common Files\PC Tools
2009-02-15 18:26 . 2004-03-09 01:00 1,081,616 --a------ c:\windows\system32\MSCOMCTL.OCX
2009-01-25 19:50 . 2009-01-25 19:50 <DIR> d-------- c:\program files\jZip

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-28 20:37 --------- d-----w c:\documents and settings\Kristen\Application Data\Move Networks
2006-11-08 01:42 92,064 ----a-w c:\documents and settings\Kristen\mqdmmdm.sys
2006-11-08 01:42 9,232 ----a-w c:\documents and settings\Kristen\mqdmmdfl.sys
2006-11-08 01:42 79,328 ----a-w c:\documents and settings\Kristen\mqdmserd.sys
2006-11-08 01:42 66,656 ----a-w c:\documents and settings\Kristen\mqdmbus.sys
2006-11-08 01:42 6,208 ----a-w c:\documents and settings\Kristen\mqdmcmnt.sys
2006-11-08 01:42 5,936 ----a-w c:\documents and settings\Kristen\mqdmwhnt.sys
2006-11-08 01:42 4,048 ----a-w c:\documents and settings\Kristen\mqdmcr.sys
2006-11-08 01:42 25,600 ----a-w c:\documents and settings\Kristen\usbsermptxp.sys
2006-11-08 01:42 22,768 ----a-w c:\documents and settings\Kristen\usbsermpt.sys
2007-10-19 21:59 61,038 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2007-10-19 21:59 49,256 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2007-10-19 22:00 166,000 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2005-07-29 20:24 472 --sha-r c:\windows\S3Jpc3Rlbg\maLDwal5v0.vbs
2008-03-09 23:49 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"AIM"="c:\program files\AIM\aim.exe" [2005-06-02 67160]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 1200128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-15 32768]
"KTPWare"="c:\program files\Elantech\Ktp.exe" [2005-03-02 253952]
"AudioDeck"="c:\program files\VIAudioi\SBADeck\ADeck.exe" [2005-03-04 512000]
"RestoreIT!"="c:\program files\Phoenix Technologies\cME\RPro\ XP\VBPTASK.EXE" [2004-10-11 114688]
"Eval"="c:\program files\Phoenix Technologies\cME\RPro\Eval\Eval.exe" [2004-11-10 1826816]
"Guard"="c:\program files\Phoenix Technologies\cME\Guard\Guard.exe" [2004-10-11 532480]
"WatchDog"="c:\program files\mobile PhoneTools\WatchDog.exe" [2004-08-13 36864]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2005-03-23 217088]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-24 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-09-25 229952]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-13 185896]
"SMSERIAL"="sm56hlpr.exe" [2004-12-29 c:\windows\sm56hlpr.exe]
"VTTimer"="VTTimer.exe" [2005-03-07 c:\windows\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-01-10 c:\windows\system32\VTTrayp.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 c:\windows\system32\bthprops.cpl]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
MA101 Configuration Utility .lnk - c:\program files\NETGEAR\MA101 USB Adapter Configuration Utility\WlanMonitor.exe [2006-05-10 163916]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-01-14 525664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2005-07-17 32320]
R0 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2005-07-17 23200]
R0 ptpd;Disk Filter Driver;c:\windows\system32\drivers\ptpd.sys [2005-07-21 6656]
R0 RITCPT;RITCPT;c:\windows\system32\drivers\RITCPT.SYS [2005-07-21 43512]
R2 FBAPI;FBAPI;c:\windows\system32\drivers\FBAPI.sys [2005-07-21 5088]
R2 Machnm32;Machnm32 Driver;c:\windows\system32\Machnm32.sys [2005-07-21 2304]
R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.SYS [2006-05-10 17149]
R3 PhnxVcd;PhnxVcd;c:\windows\system32\drivers\phnxvcd.sys [2005-07-21 36096]
S3 Ktp;Elantech Touchpad;c:\windows\system32\drivers\Ktp.sys [2005-07-17 26112]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 NETGEAR NETGEAR MA101 USB Adapter(A);NETGEAR NETGEAR MA101 USB Adapter(A) Service for NETGEAR MA101 USB Adapter;c:\windows\system32\drivers\MA1012KA.SYS [2006-05-10 73728]
S3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\PLCNDIS5.SYS [2002-09-09 17018]
.
Contents of the 'Scheduled Tasks' folder

2009-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-09-19 16:36]
.
- - - - ORPHANS REMOVED - - - -

BHO-{BEE83F72-84C7-8B35-BF2E-F18A348428E2} - (no file)
Toolbar-SITEguard - (no file)
HKCU-Run-VnrPack23 - c:\program files\VnrPack\VnrPack23.exe
HKCU-Run-GetModule37 - c:\program files\GetModule\GetModule37.exe
HKLM-RunServices-fzxpzoze - c:\windows\system32\fzxpzoze.exe
HKU-Default-RunOnce-FlashPlayerUpdate - c:\progra~1\mozill~1\plugins\NPSWF32_FlashUtil.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.averatec.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: widener.edu\alias
FF - ProfilePath - c:\documents and settings\Kristen\Application Data\Mozilla\Firefox\Profiles\l9jz0ydt.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-i3752&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.gmail.com/
FF - prefs.js: keyword.URL - hxxp://www.ffgoo.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\documents and settings\Kristen\Application Data\Mozilla\Firefox\Profiles\l9jz0ydt.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
FF - component: c:\documents and settings\Kristen\Application Data\Mozilla\Firefox\Profiles\l9jz0ydt.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll

---- FIREFOX POLICIES ----

FF - user.js: browser.search.selectedEngine - GoogleCOM
FF - user.js: keyword.URL - hxxp://www.ffgoo.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true);
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-22 20:42:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\windows\system32\o2flash.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\PhnxCDSvr.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\MICROS~3\rapimgr.exe
.
**************************************************************************
.
Completion time: 2009-02-22 20:46:22 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-23 01:46:04
ComboFix2.txt 2007-06-05 23:15:08

Pre-Run: 62,929,506,304 bytes free
Post-Run: 62,922,539,008 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

243 --- E O F --- 2009-02-16 00:37:17
louriec is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-22-2009, 07:01 PM   #4 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,761
OS: 2000 Pro; XP Pro; XP Home


Re: POP UP CITY, part 2
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------
  1. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
  2. Open notepad and copy/paste the text in the quotebox below into it:

    Quote:
    Folder::
    c:\windows\S3Jpc3Rlbg

    FileLook::
    c:\windows\system32\PLCNDIS5.SYS

    Registry::
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegedit"=-
    Save this as CFScript.txt




    Referring to the picture above, drag CFScript.txt into ComboFix.exe


  3. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  4. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    ---------------------------------------------------------------------------------------------
  5. Ensure your AntiVirus and AntiSpyware applications are re-enabled. A reboot should have done this.


    ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-23-2009, 03:48 PM   #5 (permalink)
Registered User
 
Join Date: Feb 2008
Posts: 9
OS: vista


Re: POP UP CITY, part 2
Alright, here are the results. Thanks again.





ComboFix 09-02-21.01 - Kristen 2009-02-23 17:39:38.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.184 [GMT -5:00]
Running from: c:\documents and settings\Kristen\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Kristen\Desktop\CFScript.txt.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-01-23 to 2009-02-23 )))))))))))))))))))))))))))))))
.

2009-02-21 11:32 . 2009-02-21 11:32 <DIR> d-------- c:\documents and settings\All Users\Application Data\WinZip
2009-02-21 11:26 . 2009-02-21 11:26 <DIR> d-------- c:\program files\7-Zip
2009-02-21 11:15 . 2009-02-21 11:15 250 --a------ c:\windows\gmer.ini
2009-02-15 19:34 . 2009-02-22 20:30 <DIR> d-------- c:\program files\Trojan Remover
2009-02-15 19:34 . 2006-05-25 14:52 162,304 --a------ c:\windows\system32\ztvunrar36.dll
2009-02-15 19:34 . 2003-02-02 19:06 153,088 --a------ c:\windows\system32\UNRAR3.dll
2009-02-15 19:34 . 2005-08-26 00:50 77,312 --a------ c:\windows\system32\ztvunace26.dll
2009-02-15 19:34 . 2002-03-06 00:00 75,264 --a------ c:\windows\system32\unacev2.dll
2009-02-15 19:34 . 2006-06-19 12:01 69,632 --a------ c:\windows\system32\ztvcabinet.dll
2009-02-15 19:33 . 2009-02-15 19:33 <DIR> d-------- c:\windows\EHome
2009-02-15 18:28 . 2009-02-15 18:28 <DIR> d-------- c:\documents and settings\Kristen\Application Data\Malwarebytes
2009-02-15 18:28 . 2009-02-15 18:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-15 18:27 . 2009-02-15 18:27 <DIR> d-------- c:\program files\IObit
2009-02-15 18:27 . 2009-02-15 18:27 <DIR> d-------- c:\documents and settings\Kristen\Application Data\IObit
2009-02-15 18:27 . 2009-02-22 20:32 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-02-15 18:26 . 2009-02-15 18:26 <DIR> d-------- c:\program files\Common Files\PC Tools
2009-02-15 18:26 . 2004-03-09 01:00 1,081,616 --a------ c:\windows\system32\MSCOMCTL.OCX
2009-01-25 19:50 . 2009-01-25 19:50 <DIR> d-------- c:\program files\jZip

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-28 20:37 --------- d-----w c:\documents and settings\Kristen\Application Data\Move Networks
2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll
2006-11-08 01:42 92,064 ----a-w c:\documents and settings\Kristen\mqdmmdm.sys
2006-11-08 01:42 9,232 ----a-w c:\documents and settings\Kristen\mqdmmdfl.sys
2006-11-08 01:42 79,328 ----a-w c:\documents and settings\Kristen\mqdmserd.sys
2006-11-08 01:42 66,656 ----a-w c:\documents and settings\Kristen\mqdmbus.sys
2006-11-08 01:42 6,208 ----a-w c:\documents and settings\Kristen\mqdmcmnt.sys
2006-11-08 01:42 5,936 ----a-w c:\documents and settings\Kristen\mqdmwhnt.sys
2006-11-08 01:42 4,048 ----a-w c:\documents and settings\Kristen\mqdmcr.sys
2006-11-08 01:42 25,600 ----a-w c:\documents and settings\Kristen\usbsermptxp.sys
2006-11-08 01:42 22,768 ----a-w c:\documents and settings\Kristen\usbsermpt.sys
2007-10-19 21:59 61,038 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2007-10-19 21:59 49,256 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2007-10-19 22:00 166,000 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2008-03-09 23:49 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.


---- c:\windows\system32\PLCNDIS5.SYS ----
Company: Intellon, Inc.
File Description: PLC NDIS 5.0 Protocol Driver
File Version: 5.03.16.54
Product Name: PCAUSA Rawether for Windows
Copyright: Copyright c 2002 Intellon, Inc.
Original file name: PLCNDIS5.SYS
MD5: 9fa04a9accc08030d87168b5559a4869


((((((((((((((((((((((((((((( SnapShot@2009-02-22_20.45.12.10 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-23 01:25:42 53,634 ----a-w c:\windows\system32\perfc009.dat
+ 2009-02-23 22:03:53 53,634 ----a-w c:\windows\system32\perfc009.dat
- 2009-02-23 01:25:43 381,930 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-23 22:03:53 381,930 ----a-w c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"AIM"="c:\program files\AIM\aim.exe" [2005-06-02 67160]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 1200128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-15 32768]
"KTPWare"="c:\program files\Elantech\Ktp.exe" [2005-03-02 253952]
"AudioDeck"="c:\program files\VIAudioi\SBADeck\ADeck.exe" [2005-03-04 512000]
"RestoreIT!"="c:\program files\Phoenix Technologies\cME\RPro\ XP\VBPTASK.EXE" [2004-10-11 114688]
"Eval"="c:\program files\Phoenix Technologies\cME\RPro\Eval\Eval.exe" [2004-11-10 1826816]
"Guard"="c:\program files\Phoenix Technologies\cME\Guard\Guard.exe" [2004-10-11 532480]
"WatchDog"="c:\program files\mobile PhoneTools\WatchDog.exe" [2004-08-13 36864]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2005-03-23 217088]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-24 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-09-25 229952]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-13 185896]
"SMSERIAL"="sm56hlpr.exe" [2004-12-29 c:\windows\sm56hlpr.exe]
"VTTimer"="VTTimer.exe" [2005-03-07 c:\windows\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-01-10 c:\windows\system32\VTTrayp.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 c:\windows\system32\bthprops.cpl]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
MA101 Configuration Utility .lnk - c:\program files\NETGEAR\MA101 USB Adapter Configuration Utility\WlanMonitor.exe [2006-05-10 163916]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-01-14 525664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2005-07-17 32320]
R0 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2005-07-17 23200]
R0 ptpd;Disk Filter Driver;c:\windows\system32\drivers\ptpd.sys [2005-07-21 6656]
R0 RITCPT;RITCPT;c:\windows\system32\drivers\RITCPT.SYS [2005-07-21 43512]
R2 FBAPI;FBAPI;c:\windows\system32\drivers\FBAPI.sys [2005-07-21 5088]
R2 Machnm32;Machnm32 Driver;c:\windows\system32\Machnm32.sys [2005-07-21 2304]
R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.SYS [2006-05-10 17149]
R3 PhnxVcd;PhnxVcd;c:\windows\system32\drivers\phnxvcd.sys [2005-07-21 36096]
S3 Ktp;Elantech Touchpad;c:\windows\system32\drivers\Ktp.sys [2005-07-17 26112]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 NETGEAR NETGEAR MA101 USB Adapter(A);NETGEAR NETGEAR MA101 USB Adapter(A) Service for NETGEAR MA101 USB Adapter;c:\windows\system32\drivers\MA1012KA.SYS [2006-05-10 73728]
S3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\PLCNDIS5.SYS [2002-09-09 17018]
.
Contents of the 'Scheduled Tasks' folder

2009-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-09-19 16:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.averatec.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: widener.edu\alias
FF - ProfilePath - c:\documents and settings\Kristen\Application Data\Mozilla\Firefox\Profiles\l9jz0ydt.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-i3752&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.gmail.com/
FF - prefs.js: keyword.URL - hxxp://www.ffgoo.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\documents and settings\Kristen\Application Data\Mozilla\Firefox\Profiles\l9jz0ydt.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
FF - component: c:\documents and settings\Kristen\Application Data\Mozilla\Firefox\Profiles\l9jz0ydt.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll

---- FIREFOX POLICIES ----

FF - user.js: browser.search.selectedEngine - GoogleCOM
FF - user.js: keyword.URL - hxxp://www.ffgoo.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true);
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-23 17:41:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-23 17:43:41
ComboFix-quarantined-files.txt 2009-02-23 22:43:14
ComboFix2.txt 2009-02-23 22:32:12
ComboFix3.txt 2009-02-23 01:46:23
ComboFix4.txt 2007-06-05 23:15:08

Pre-Run: 62,899,220,480 bytes free
Post-Run: 62,886,039,552 bytes free

167 --- E O F --- 2009-02-16 00:37:17
louriec is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-23-2009, 05:47 PM   #6 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,761
OS: 2000 Pro; XP Pro; XP Home


Re: POP UP CITY, part 2
P2P - I see you have P2P software ( LimeWire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing

I would strongly recommend that you uninstall this. You can do so via Control Panel >> Add or Remove Programs.

---------------------------------------------------------------------------------------------


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 12. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u12-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      • Applications and Applets
        Trace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.

---------------------------------------------------------------------------------------------

Your version of Firefox is very outdated also Mozilla Firefox (1.5.0.12), and is no longer having security updates issued for it. I'd suggest upgrading to Firefox 3

http://www.mozilla.com/en-US/firefox/

Some of your addons (extensions) may not work with FF3, but by now there have been many new addons created to replace those for older versions of FF.

---------------------------------------------------------------------------------------------

Please run this online scan to help look for remnants.

Perform an online scan with Panda ActiveScan
  • Click on Scan Your PC Now
  • A "pop up" window will appear, or a new tab will open.
  • Click on Register
  • Choose the option you like most, but we recommend the Free Registration.
  • Click on Register
  • Enter your e-mail address, and create a password.
  • Select "I do not want to receive any type of information". (unless you want to receive such information)
  • Click on Send
  • Confirm registration, and continue by entering your user name and password, then click on Enter
  • Select Full Scan, then Click on Scan Now
  • Wait for the components to be loaded and installed. Don't close this window or go to another page while it is downloading. You can continue using the Internet by opening another window in your browser.
  • If it finds any malware it can disinfect, the Disinfect button will be enabled. Click on Disinfect
  • Please ignore the offer to buy the program. Click on Export To
  • Export the log and save it to your desktop.
  • Please attach the contents of that log to your reply.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

---------------------------------------------------------------------------------------------

How is the machine behaving?
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-25-2009, 06:54 PM   #7 (permalink)
Registered User
 
Join Date: Feb 2008
Posts: 9
OS: vista


Re: POP UP CITY, part 2
Alrighty so here is the exported file. Seems like the pop ups have stopped. I followed all your instructions and updated all the suggested applications. Below is the exported file from the Panda Scan. Thanks again!






;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-02-25 20:44:41
PROTECTIONS: 0
MALWARE: 47
SUSPECTS: 2
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@casalemedia[2].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.doubleclick.net/]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Cedric\Cookies\cedric@doubleclick[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@doubleclick[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@atdmt[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Cedric\Cookies\cedric@atdmt[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.atdmt.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.247realmedia.com/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@fastclick[1].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.tribalfusion.com/]
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@tribalfusion[1].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Cedric\Cookies\cedric@mediaplex[2].txt
00159564 Cookie/WUpd TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@revenue[2].txt
00160284 Cookie/Findwhat TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.findwhat.com/]
00167430 Cookie/myaffiliateprogram TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@www.myaffiliateprogram[1].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.xiti.com/]
00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@toplist[1].txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@statcounter[2].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@ad.yieldmanager[2].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[ad.yieldmanager.com/]
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@apmebf[1].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@advertising[1].txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@ads.pointroll[1].txt
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@realmedia[1].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@questionmarket[1].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.questionmarket.com/]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@zedo[1].txt
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.adultfriendfinder.com/]
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@adultfriendfinder[1].txt
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.adultfriendfinder.com/]
00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.target.com/]
00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@target[2].txt
00219235 Adware/CommAd Adware No 0 Yes No C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP384\A0119121.dll
00219238 Adware/CommAd Adware No 0 Yes No C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP386\A0119266.exe
00219238 Adware/CommAd Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\S3Jpc3Rlbg\command.exe.vir.vir
00242884 Adware/SearchAid Adware No 0 Yes No C:\QooBox\Quarantine\C\Program Files\Network Monitor\netmon.exe.vir.vir
00251146 Adware/SearchAid Adware No 0 Yes No C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP388\A0119703.vbs
00251146 Adware/SearchAid Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\uninstall_nmon.vbs.vir
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@atwola[1].txt
00262492 Adware/CommAd Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\S3Jpc3Rlbg\maLDwal5v0.vbs.vir
00262492 Adware/CommAd Adware No 0 Yes No C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP389\A0119802.vbs
00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@ads.addynamix[2].txt
00332832 Adware/DollarRevenue Adware No 1 Yes No C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP384\A0118898.dll
00358014 Adware/Yazzle Adware No 0 Yes No C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP388\A0119702.exe
00358014 Adware/Yazzle Adware No 0 Yes No C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1122OinUninstaller.exe.vir
00593436 W32/Autorun.AQG.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP389\A0119798.bat
00593436 W32/Autorun.AQG.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP390\A0119863.bat
00593436 W32/Autorun.AQG.worm Virus/Worm No 1 No No C:\Documents and Settings\Kristen\Desktop\ComboFix.exe[32788R22FWJFW\List.bat]
00593436 W32/Autorun.AQG.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP388\A0119684.bat
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP388\A0119732.EXE
01196325 Cookie/Enhance TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.enhance.com/]
01196325 Cookie/Enhance TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\eop5hty8.default\cookies.txt[.enhance.com/]
01196325 Cookie/Enhance TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@enhance[1].txt
01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\Kristen\Cookies\kristen@adserver.easyad[1].txt
01895148 Malicious Packer SecRisk No 0 Yes No C:\WINDOWS\spoolstr.exe
01895148 Malicious Packer SecRisk No 0 Yes No C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP384\A0118897.exe
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes Yes C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP388\A0119708.sys
02888175 Adware/Zenosearch Adware No 0 Yes No C:\QooBox\Quarantine\C\Program Files\Outerinfo\FF\components\FF.dll.vir.vir
02888175 Adware/Zenosearch Adware No 0 Yes No C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP386\A0119268.dll
02905446 Trj/Dropper.ABG Virus/Trojan No 0 Yes Yes C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP386\A0119270.exe
02905446 Trj/Dropper.ABG Virus/Trojan No 0 Yes Yes C:\WINDOWS\b152.exe.vir
02907634 Adware/PurityScan Adware No 0 Yes No C:\QooBox\Quarantine\C\Documents and Settings\Kristen\Application Data\MCROSO~1\rυndll32.exe.vir
02908707 Trj/DNSQuery.B Virus/Trojan No 0 Yes Yes C:\WINDOWS\b154.exe.vir
02908707 Trj/DNSQuery.B Virus/Trojan No 0 Yes Yes C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP386\A0119272.exe
02941683 ASF/GetaCodec.A Virus No 0 Yes Yes C:\Documents and Settings\Kristen\My Documents\My Music\iTunes\Incomplete\Preview-T-5745425-white horse taylor swift.mp3
02941683 ASF/GetaCodec.A Virus No 0 Yes Yes C:\Documents and Settings\Kristen\My Documents\My Music\iTunes\iTunes Music\white horse taylor swift.mp3
03491702 Adware/JavaCore Adware No 0 Yes No C:\QooBox\Quarantine\C\Program Files\JavaCore\UnInstall.exe.vir
03899466 Adware/PurityScan Adware No 0 No No C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP388\A0119693.exe[UE.exe]
03899466 Adware/PurityScan Adware No 0 No No C:\QooBox\Quarantine\C\Program Files\Outerinfo\OiUninstaller.exe.vir[UE.exe]
03962010 Trj/Downloader.MDW Virus/Trojan No 0 Yes Yes C:\QooBox\Quarantine\C\Documents and Settings\Kristen\Application Data\Facegame\Facegame.exe5s5.vir
03962010 Trj/Downloader.MDW Virus/Trojan No 0 Yes Yes C:\QooBox\Quarantine\C\Documents and Settings\Kristen\Application Data\Facegame\Facegame.exe.vir.vir
04894077 Trj/Downloader.MDW Virus/Trojan No 1 Yes Yes C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP388\A0119695.exe
04894077 Trj/Downloader.MDW Virus/Trojan No 1 Yes Yes C:\QooBox\Quarantine\C\Program Files\VnrPack\VnrPack23.exe.vir
05022079 Generic Malware Virus/Trojan No 0 Yes Yes C:\System Volume Information\_restore{C3E81394-22D4-4D39-A6C9-B2E75485A7E4}\RP388\A0119688.exe
05022079 Generic Malware Virus/Trojan No 0 Yes Yes C:\QooBox\Quarantine\C\Program Files\GetModule\GetModule37.exe.vir
;===================================================================================================================================================================================
SUSPECTS
Sent Location
;===================================================================================================================================================================================
No C:\aol.exe
No C:\aolsoftware.exe
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description
;===================================================================================================================================================================================
;===================================================================================================================================================================================
louriec is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-25-2009, 07:00 PM   #8 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,761
OS: 2000 Pro; XP Pro; XP Home


Re: POP UP CITY, part 2
Please go to: VirusTotal
  • On the page you'll find a "Browse" button.
  • Next to the browse button you'll see a box to enter text.
  • Please copy/paste the following:

    C:\aol.exe

  • Then click the "Send File " button just below.
  • This will scan the file. Please be patient.
  • If you get a message saying File has already been analyzed: click Reanalyze file now
  • Once scanned, copy and paste the results in your next reply, or just copy/paste the link to the results page.
  • Please repeat for the following files:

    • C:\aolsoftware.exe

__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-26-2009, 04:43 PM   #9 (permalink)
Registered User
 
Join Date: Feb 2008
Posts: 9
OS: vista


Re: POP UP CITY, part 2
Alrighty here are the results to C:\aol.exe


Antivirus Version Last Update Result
a-squared 4.0.0.101 2009.02.27 -
AntiVir 7.9.0.93 2009.02.26 TR/Crypt.Morphine.Gen
Authentium 5.1.0.4 2009.02.27 W32/Troj_Obfusc.A.gen!Eldorado
Avast 4.8.1335.0 2009.02.26 Win32:Obfuscated
AVG 8.0.0.237 2009.02.26 Downloader.Obfuskated
BitDefender 7.2 2009.02.26 Trojan.Obfus.3.Gen
CAT-QuickHeal 10.00 2009.02.26 Win32.Trojan.Obfuscated.gy.a
ClamAV 0.94.1 2009.02.26 -
Comodo 986 2009.02.20 -
DrWeb 4.44.0.09170 2009.02.27 -
eSafe 7.0.17.0 2009.02.26 -
eTrust-Vet 31.6.6375 2009.02.26 Win32/Cotmonger
F-Prot 4.4.4.56 2009.02.26 W32/Troj_Obfusc.A.gen!Eldorado
F-Secure 8.0.14470.0 2009.02.26 Trojan.Win32.Obfuscated.gy
Fortinet 3.117.0.0 2009.02.26 -
GData 19 2009.02.26 Trojan.Obfus.3.Gen
Ikarus T3.1.1.45.0 2009.02.26 -
K7AntiVirus 7.10.648 2009.02.26 -
Kaspersky 7.0.0.125 2009.02.27 Trojan.Win32.Obfuscated.gy
McAfee 5537 2009.02.26 -
McAfee+Artemis 5537 2009.02.26 -
Microsoft 1.4306 2009.02.26 VirTool:Win32/Obfuscator.BL
NOD32 3893 2009.02.26 Win32/Obfuscated.GY
Norman 6.00.06 2009.02.26 Smalltroj.BVER
nProtect 2009.1.8.0 2009.02.26 -
Panda 10.0.0.10 2009.02.26 Suspicious file
PCTools 4.4.2.0 2009.02.26 -
Prevx1 V2 2009.02.27 -
Rising 21.18.32.00 2009.02.26 -
SecureWeb-Gateway 6.0.0 2009.02.26 Trojan.Crypt.Morphine.Gen
Sophos 4.39.0 2009.02.26 Mal/EncPk-Y
Sunbelt 3.2.1858.2 2009.02.26 -
Symantec 10 2009.02.27 Suspicious.MH690.A
TheHacker 6.3.2.5.266 2009.02.26 -
TrendMicro 8.700.0.1004 2009.02.26 -
VBA32 3.12.10.1 2009.02.26 -
ViRobot 2009.2.26.1625 2009.02.26 Trojan.Win32.Obfuscated.9252
VirusBuster 4.5.11.0 2009.02.26 -
Additional information
File size: 33924 bytes
MD5...: 133062e596b83c8bb9b4c42febb93455
SHA1..: a52040948076f34d70be52e0a209db3438c10741
SHA256: 0dc3957a979b42c59b245dcfc31e7e4c5085d44018f16eb947c349b6060b3520
SHA512: 6f168fdb363221fb0d250c606cc5b044d99ac8307b3f98d3efb1de45947c3f6a
d10d37378b42418684a3c6aae6a3626dd288b8533cc9318416f7314b66542dd0
ssdeep: 768:M3jNcI6C1YHdyg1FQCFFBqf1KpALOVu/NNZoyfihTuLh4eltWlES:M3eIxsd
h3QO8fhCOOnSLhn3WT
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (67.8%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
VXD Driver (0.2%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x12000
timedatestamp.....: 0x443b8853 (Tue Apr 11 10:43:31 2006)
machinetype.......: 0x14c (I386)

( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
.idata 0x1000 0x74 0x200 1.04 8292b5531684124ccc97306f4c5bdeb7
.code 0x2000 0x1e8e6 0x1f000 6.99 4dd46edda74b671fad2133294f3db65a

( 1 imports )
> kernel32.dll: VirtualAlloc, GetProcAddress, LoadLibraryA

( 0 exports )



And here are the results to C:\aolsoftware.exe





File aolsoftware.exe received on 02.27.2009 00:40:59 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 19/37 (51.36%)
Loading server information...
Your file is queued in position: ___.
Estimated start time is between ___ and ___ .
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
a-squared 4.0.0.101 2009.02.27 -
AntiVir 7.9.0.93 2009.02.26 TR/Crypt.Morphine.Gen
Authentium 5.1.0.4 2009.02.27 W32/Troj_Obfusc.A.gen!Eldorado
Avast 4.8.1335.0 2009.02.26 Win32:Obfuscated
AVG 8.0.0.237 2009.02.26 Downloader.Obfuskated
BitDefender 7.2 2009.02.26 Trojan.Obfus.3.Gen
CAT-QuickHeal 10.00 2009.02.26 -
ClamAV 0.94.1 2009.02.26 -
Comodo 986 2009.02.20 -
DrWeb 4.44.0.09170 2009.02.27 -
eSafe 7.0.17.0 2009.02.26 -
eTrust-Vet 31.6.6375 2009.02.26 Win32/Cotmonger
F-Prot 4.4.4.56 2009.02.26 W32/Troj_Obfusc.A.gen!Eldorado
F-Secure 8.0.14470.0 2009.02.27 Trojan.Win32.Obfuscated.gy
Fortinet 3.117.0.0 2009.02.26 -
GData 19 2009.02.26 Trojan.Obfus.3.Gen
Ikarus T3.1.1.45.0 2009.02.26 -
K7AntiVirus 7.10.648 2009.02.26 -
Kaspersky 7.0.0.125 2009.02.27 Trojan.Win32.Obfuscated.gy
McAfee 5537 2009.02.26 -
McAfee+Artemis 5537 2009.02.26 -
Microsoft 1.4306 2009.02.26 VirTool:Win32/Obfuscator.BL
NOD32 3893 2009.02.26 Win32/Obfuscated.GY
Norman 6.00.06 2009.02.26 Oderoor.gen1
nProtect 2009.1.8.0 2009.02.26 -
Panda 10.0.0.10 2009.02.26 Suspicious file
PCTools 4.4.2.0 2009.02.26 -
Rising 21.18.32.00 2009.02.26 -
SecureWeb-Gateway 6.0.0 2009.02.26 Trojan.Crypt.Morphine.Gen
Sophos 4.39.0 2009.02.26 Mal/EncPk-Y
Sunbelt 3.2.1858.2 2009.02.26 -
Symantec 10 2009.02.27 Suspicious.MH690.A
TheHacker 6.3.2.5.266 2009.02.26 -
TrendMicro 8.700.0.1004 2009.02.26 TROJ_OBFUSCA.GEN
VBA32 3.12.10.1 2009.02.26 -
ViRobot 2009.2.26.1625 2009.02.26 Trojan.Win32.Obfuscated.9252
VirusBuster 4.5.11.0 2009.02.26 -
Additional information
File size: 4626 bytes
MD5...: 5e231c25def33fa8459c7318bb43bfdf
SHA1..: d69a9d674f10daa5bd1fe9c53bb02bab03486491
SHA256: cc8b0daac89d9321ac050ab5fefd9de704df2de99a47a624dd39a961f9acec2f
SHA512: 709c8ddc3f8d37ad53af9cc4bb58377ec4da6b9aa210125bdbbc6b88fda74a14
80203edf7ec41651cb0dbf343d63749d29dc0557315eab2e78cc79ee86c840c8
ssdeep: 48:Zvt1dy/iSmyBZ6dK9jkhsGp49blzUyVcFg5sVvB1nF8LwGHiyaXX4V3Q+Oc4E
Myy:Z1tjYjMJ0ldOHVJxF8sTH6O71ybCf
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (67.8%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
VXD Driver (0.2%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x12000
timedatestamp.....: 0x46ff6814 (Sun Sep 30 09:10:44 2007)
machinetype.......: 0x14c (I386)

( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
.idata 0x1000 0x74 0x200 1.04 8292b5531684124ccc97306f4c5bdeb7
.code 0x2000 0x29b5a 0x2a000 6.79 aedf42c344ac7cc3124339b7ec6285eb

( 1 imports )
> kernel32.dll: VirtualAlloc, GetProcAddress, LoadLibraryA

( 0 exports )
louriec is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-26-2009, 06:11 PM   #10 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,761
OS: 2000 Pro; XP Pro; XP Home


Re: POP UP CITY, part 2
Hi -

I'd like to collect those files using ComboFix

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------
  1. Please download ATF Cleaner by Atribune.
    • Double-click ATF-Cleaner.exe to run the program.
      Under Main choose: Select All
      Click the Empty Selected button.
    If you use Firefox browser
    • Click Firefox at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    If you use Opera browser
    • Click Opera at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Click Exit on the Main menu to close the program.
    For Technical Support, double-click the e-mail address located at the bottom of each menu.

    ---------------------------------------------------------------------------------------------

  2. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:

    Quote:
    http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/348526-pop-up-city-part-2-a.html#post1992729

    Collect::
    C:\WINDOWS\spoolstr.exe
    C:\aol.exe
    C:\aolsoftware.exe
    Save this as CFScript.txt




    Referring to the picture above, drag CFScript.txt into ComboFix.exe


  4. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  5. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    When ComboFix finishes running, the ComboFix log will open along with a message box--do not be alarmed.. With the above script, ComboFix will capture a file to submit for analysis.

    Ensure you are connected to the internet and click OK. Follow the prompts.
  6. Ensure your AntiVirus and AntiSpyware applications are re-enabled.

    ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-27-2009, 06:29 AM   #11 (permalink)
Registered User
 
Join Date: Feb 2008
Posts: 9
OS: vista


Re: POP UP CITY, part 2
Alrighty, here's the log from ComboFix:




ComboFix 09-02-21.01 - Kristen 2009-02-27 8:21:00.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.199 [GMT -5:00]
Running from: c:\documents and settings\Kristen\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Kristen\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\aol.exe
C:\aolsoftware.exe
c:\windows\spoolstr.exe

.
((((((((((((((((((((((((( Files Created from 2009-01-27 to 2009-02-27 )))))))))))))))))))))))))))))))
.

2009-02-25 19:27 . 2008-06-19 16:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2009-02-24 16:44 . 2009-02-24 16:44 <DIR> d-------- c:\program files\Panda Security
2009-02-24 16:25 . 2009-02-24 16:24 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-24 16:25 . 2009-02-24 16:24 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-21 11:32 . 2009-02-21 11:32 <DIR> d-------- c:\documents and settings\All Users\Application Data\WinZip
2009-02-21 11:26 . 2009-02-21 11:26 <DIR> d-------- c:\program files\7-Zip
2009-02-21 11:15 . 2009-02-21 11:15 250 --a------ c:\windows\gmer.ini
2009-02-15 19:34 . 2009-02-22 20:30 <DIR> d-------- c:\program files\Trojan Remover
2009-02-15 19:34 . 2006-05-25 14:52 162,304 --a------ c:\windows\system32\ztvunrar36.dll
2009-02-15 19:34 . 2003-02-02 19:06 153,088 --a------ c:\windows\system32\UNRAR3.dll
2009-02-15 19:34 . 2005-08-26 00:50 77,312 --a------ c:\windows\system32\ztvunace26.dll
2009-02-15 19:34 . 2002-03-06 00:00 75,264 --a------ c:\windows\system32\unacev2.dll
2009-02-15 19:34 . 2006-06-19 12:01 69,632 --a------ c:\windows\system32\ztvcabinet.dll
2009-02-15 19:33 . 2009-02-15 19:33 <DIR> d-------- c:\windows\EHome
2009-02-15 18:28 . 2009-02-15 18:28 <DIR> d-------- c:\documents and settings\Kristen\Application Data\Malwarebytes
2009-02-15 18:28 . 2009-02-15 18:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-15 18:27 . 2009-02-15 18:27 <DIR> d-------- c:\program files\IObit
2009-02-15 18:27 . 2009-02-15 18:27 <DIR> d-------- c:\documents and settings\Kristen\Application Data\IObit
2009-02-15 18:27 . 2009-02-22 20:32 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-02-15 18:26 . 2009-02-15 18:26 <DIR> d-------- c:\program files\Common Files\PC Tools
2009-02-15 18:26 . 2004-03-09 01:00 1,081,616 --a------ c:\windows\system32\MSCOMCTL.OCX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-24 21:24 --------- d-----w c:\program files\Java
2009-01-28 20:37 --------- d-----w c:\documents and settings\Kristen\Application Data\Move Networks
2009-01-26 00:50 --------- d-----w c:\program files\jZip
2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll
2006-11-08 01:42 92,064 ----a-w c:\documents and settings\Kristen\mqdmmdm.sys
2006-11-08 01:42 9,232 ----a-w c:\documents and settings\Kristen\mqdmmdfl.sys
2006-11-08 01:42 79,328 ----a-w c:\documents and settings\Kristen\mqdmserd.sys
2006-11-08 01:42 66,656 ----a-w c:\documents and settings\Kristen\mqdmbus.sys
2006-11-08 01:42 6,208 ----a-w c:\documents and settings\Kristen\mqdmcmnt.sys
2006-11-08 01:42 5,936 ----a-w c:\documents and settings\Kristen\mqdmwhnt.sys
2006-11-08 01:42 4,048 ----a-w c:\documents and settings\Kristen\mqdmcr.sys
2006-11-08 01:42 25,600 ----a-w c:\documents and settings\Kristen\usbsermptxp.sys
2006-11-08 01:42 22,768 ----a-w c:\documents and settings\Kristen\usbsermpt.sys
2008-03-09 23:49 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-02-22_20.45.12.10 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-26 03:34:01 8,460,288 -c--a-w c:\windows\system32\dllcache\shell32.dll
+ 2008-07-03 13:03:29 8,460,800 -c--a-w c:\windows\system32\dllcache\shell32.dll
- 2007-09-25 02:30:28 135,168 ----a-w c:\windows\system32\java.exe
+ 2009-02-24 21:24:54 144,792 ----a-w c:\windows\system32\java.exe
- 2007-09-25 02:30:30 135,168 ----a-w c:\windows\system32\javaw.exe
+ 2009-02-24 21:24:54 144,792 ----a-w c:\windows\system32\javaw.exe
- 2007-09-25 03:31:42 139,264 ----a-w c:\windows\system32\javaws.exe
+ 2009-02-24 21:24:54 148,888 ----a-w c:\windows\system32\javaws.exe
- 2009-02-23 01:25:42 53,634 ----a-w c:\windows\system32\perfc009.dat
+ 2009-02-27 01:18:34 53,634 ----a-w c:\windows\system32\perfc009.dat
- 2009-02-23 01:25:43 381,930 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-27 01:18:34 381,930 ----a-w c:\windows\system32\perfh009.dat
- 2007-10-26 03:34:01 8,460,288 ----a-w c:\windows\system32\shell32.dll
+ 2008-07-03 13:03:29 8,460,800 ----a-w c:\windows\system32\shell32.dll
- 2007-10-29 10:04:03 350,720 ----a-w c:\windows\system32\xpsp3res.dll
+ 2008-02-15 0921 351,744 ----a-w c:\windows\system32\xpsp3res.dll
+ 2009-02-27 01:14:31 16,384 ----atw c:\windows\temp\Perflib_Perfdata_734.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"AIM"="c:\program files\AIM\aim.exe" [2005-06-02 67160]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 1200128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-15 32768]
"KTPWare"="c:\program files\Elantech\Ktp.exe" [2005-03-02 253952]
"AudioDeck"="c:\program files\VIAudioi\SBADeck\ADeck.exe" [2005-03-04 512000]
"RestoreIT!"="c:\program files\Phoenix Technologies\cME\RPro\ XP\VBPTASK.EXE" [2004-10-11 114688]
"Eval"="c:\program files\Phoenix Technologies\cME\RPro\Eval\Eval.exe" [2004-11-10 1826816]
"Guard"="c:\program files\Phoenix Technologies\cME\Guard\Guard.exe" [2004-10-11 532480]
"WatchDog"="c:\program files\mobile PhoneTools\WatchDog.exe" [2004-08-13 36864]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2005-03-23 217088]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-24 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-09-25 229952]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-13 185896]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-24 148888]
"SMSERIAL"="sm56hlpr.exe" [2004-12-29 c:\windows\sm56hlpr.exe]
"VTTimer"="VTTimer.exe" [2005-03-07 c:\windows\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-01-10 c:\windows\system32\VTTrayp.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 c:\windows\system32\bthprops.cpl]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
MA101 Configuration Utility .lnk - c:\program files\NETGEAR\MA101 USB Adapter Configuration Utility\WlanMonitor.exe [2006-05-10 163916]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-01-14 525664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2005-07-17 32320]
R0 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2005-07-17 23200]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-02-25 28544]
R0 ptpd;Disk Filter Driver;c:\windows\system32\drivers\ptpd.sys [2005-07-21 6656]
R0 RITCPT;RITCPT;c:\windows\system32\drivers\RITCPT.SYS [2005-07-21 43512]
R2 FBAPI;FBAPI;c:\windows\system32\drivers\FBAPI.sys [2005-07-21 5088]
R2 Machnm32;Machnm32 Driver;c:\windows\system32\Machnm32.sys [2005-07-21 2304]
R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.SYS [2006-05-10 17149]
R3 PhnxVcd;PhnxVcd;c:\windows\system32\drivers\phnxvcd.sys [2005-07-21 36096]
S3 Ktp;Elantech Touchpad;c:\windows\system32\drivers\Ktp.sys [2005-07-17 26112]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 NETGEAR NETGEAR MA101 USB Adapter(A);NETGEAR NETGEAR MA101 USB Adapter(A) Service for NETGEAR MA101 USB Adapter;c:\windows\system32\drivers\MA1012KA.SYS [2006-05-10 73728]
S3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\PLCNDIS5.SYS [2002-09-09 17018]
.
Contents of the 'Scheduled Tasks' folder

2009-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-09-19 16:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.averatec.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: widener.edu\alias
FF - ProfilePath - c:\documents and settings\Kristen\Application Data\Mozilla\Firefox\Profiles\l9jz0ydt.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-i3752&p=
FF - prefs.js: browser.search.selectedEngine - GoogleCOM
FF - prefs.js: browser.startup.homepage - hxxp://www.gmail.com/
FF - prefs.js: keyword.URL - hxxp://www.ffgoo.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\documents and settings\Kristen\Application Data\Mozilla\Firefox\Profiles\l9jz0ydt.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll

---- FIREFOX POLICIES ----

FF - user.js: browser.search.selectedEngine - GoogleCOM
FF - user.js: keyword.URL - hxxp://www.ffgoo.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-27 08:23:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-27 8:25:22
ComboFix-quarantined-files.txt 2009-02-27 13:24:56
ComboFix2.txt 2009-02-23 22:43:42
ComboFix3.txt 2009-02-23 22:32:12
ComboFix4.txt 2009-02-23 01:46:23
ComboFix5.txt 2009-02-27 13:20:01

Pre-Run: 63,564,550,144 bytes free
Post-Run: 63,552,393,216 bytes free

172 --- E O F --- 2009-02-24 23:03:22
louriec is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-27-2009, 08:12 AM   #12 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,761
OS: 2000 Pro; XP Pro; XP Home


Re: POP UP CITY, part 2
The other items Panda found are in ComboFix quarantine or System Restore points, and will be addressed by uninstalling ComboFix as instructed below

Other than that....

Your logs appear clean.You should be good to go. We still have a few items to address.

Go to -> Run -> copy/paste in the following single line command & click OK

combofix /u



This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs:
  • Microsoft Windows Update - http://www.windowsupdate.com
    Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • SpywareBlaster to help prevent spyware from installing in the first place.
    • Install & update SpywareBlaster with the latest definitions.
      After you have updated, click the button - enable protection for all unprotected items
  • McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad.
  • Winpatrol

    Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here.

    You can get a free copy of Winpatrol or use the Plus version for more features.

    You can read Winpatrol's FAQ if you run into problems.

  • MVPS HOST FILE
    The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
    • Download Host.zip to your desktop.
    • From your Desktop right-click (hosts.zip) and select:
      Extract All from the menu.
    • Click Next, click Next, select the option:
      "Show Extracted files", click Finish
    • This will open the newly created hosts folder on your Desktop.
    • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
    • Once updated you should see another prompt that the task was completed.
  • ANTIVIRUS SOFTWARE
    It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

    Do not install more than one AntiVirus program because they will conflict with each other.

  • Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

  • http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

  • http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles
If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-28-2009, 05:23 PM   #13 (permalink)
Registered User
 
Join Date: Feb 2008
Posts: 9
OS: vista


Re: POP UP CITY, part 2


You guys are awesome. Thanks much. I've downloaded the suggested programs and hopefully won't have to contact you for help in the future! Thanks again so much.

Again,
louriec is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-28-2009, 06:09 PM   #14 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,761
OS: 2000 Pro; XP Pro; XP Home


Re: POP UP CITY, part 2
Glad to help

Quote:
hopefully won't have to contact you for help in the future
That's our hope also. Enjoy the rest of the forums as much as you like.

Surf Safely, and Think Prevention!

Since this issue is resolved, this topic will be archived.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 11:27 AM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85